CKAD Practice Test 28 — 15 Questions

Question 1

You have a Deployment with 3 replicas. You run 'kubectl rollout pause deployment/app'. Which command would you use to resume the rollout?

Accepted Answer

kubectl rollout resume deployment/app. `kubectl rollout resume deployment/app` is the specific command to resume a paused rollout, allowing the Deployment controller to continue processing updates to the Pod template. When a rollout is paused with `kubectl rollout pause`, the controller stops applying changes to the ReplicaSet; `resume` re-enables that reconciliation loop.

Answer

kubectl rollout continue deployment/app

Answer

kubectl rollout undo deployment/app

Answer

kubectl rollout restart deployment/app

Question 2

Which THREE of the following are valid fields in a PodSecurityContext that affect container security? (Select 3)

Accepted Answer

runAsUser. (runAsUser) is correct because it is a valid field in a PodSecurityContext that specifies the user ID (UID) under which all containers in the pod run. This field directly affects container security by controlling privilege levels and access to host resources, overriding the container's default user.

Answer

capabilities

Answer

privileged

Question 3

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: db' in namespace 'prod'. Which YAML snippet correctly implements this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress: []. It defines a NetworkPolicy that selects pods with label 'app: db' in namespace 'prod', specifies 'policyTypes: [Ingress]', and sets 'ingress: []'. An empty ingress rule list means no ingress traffic is allowed, effectively denying all ingress to the selected pods. This is the standard Kubernetes pattern for creating a deny-all ingress policy for a specific set of pods.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from: []

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []

Question 4

A developer wants to debug a running container in a Pod named 'web-app' in namespace 'dev'. Which command attaches an ephemeral container with the 'nicolaka/netshoot' image for network debugging?

Accepted Answer

kubectl debug web-app -n dev --image=nicolaka/netshoot -c debugger. `kubectl debug` is the dedicated command for adding an ephemeral container to a running Pod for troubleshooting. The `--image=nicolaka/netshoot` flag specifies the network debugging image, and `-c debugger` names the ephemeral container. This allows the developer to attach to the Pod's network namespace without restarting or modifying the original container.

Answer

kubectl run debugger -n dev --image=nicolaka/netshoot --restart=Never

Answer

kubectl attach web-app -n dev -c debugger --image=nicolaka/netshoot

Answer

kubectl exec -n dev web-app --image=nicolaka/netshoot -- /bin/bash

Question 5

A developer wants to ensure that a container runs as a non-root user and the filesystem is read-only except for a tmpfs volume. Which fields should be set in the container's securityContext?

Accepted Answer

runAsNonRoot: true and readOnlyRootFilesystem: true. `runAsNonRoot: true` enforces that the container cannot run as the root user (UID 0), and `readOnlyRootFilesystem: true` makes the container's filesystem read-only except for volumes explicitly mounted as writable, such as a tmpfs volume. Together, these fields satisfy the requirement of a non-root container with a read-only filesystem except for a tmpfs mount.

Answer

runAsUser: 1000 and readOnlyRootFilesystem: true

Answer

runAsNonRoot: true and privileged: false

Answer

allowPrivilegeEscalation: false and readOnlyRootFilesystem: true

Question 6

Which TWO resources are used to enforce resource quotas at the namespace level? (Select TWO.)

Accepted Answer

ResourceQuota. ResourceQuota (C) is correct because it is the Kubernetes object that enforces aggregate quotas on a namespace, capping total CPU/memory requests and limits, pod counts, and object counts such as services, secrets, and PVCs. LimitRange (E) is correct because it enforces per-container or per-pod defaults and min/max constraints within a namespace, ensuring individual workloads cannot exceed or bypass the namespace's quota boundaries. HorizontalPodAutoscaler (A) only scales replica counts based on metrics and does not enforce quotas. NetworkPolicy (B) governs pod-level ingress/egress traffic rules, not resource consumption. PodDisruptionBudget (D) limits voluntary disruptions to maintain availability, not resource usage.

Answer

HorizontalPodAutoscaler

Answer

NetworkPolicy

Answer

PodDisruptionBudget

Question 7

An Ingress resource has the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

What will the Ingress controller do for a request to http://example.com/api/v1/users?

Accepted Answer

Route the request to api-service on port 80.. The Ingress rule uses `pathType: Prefix` and a path of `/api`, which matches any request whose URL path begins with `/api`. The request to `http://example.com/api/v1/users` starts with `/api`, so the Ingress controller routes it to `api-service` on port 80. This is the standard behavior defined by the Kubernetes Ingress specification for prefix-based path matching.

Answer

Route the request to the default backend.

Answer

Return a 502 Bad Gateway error.

Answer

Return 404 Not Found because the path does not match exactly.

Question 8

Which TWO methods can be used to expose a Secret's data as environment variables inside a container? (Select 2)

Accepted Answer

Using 'env.valueFrom.secretKeyRef'. `env.valueFrom.secretKeyRef` allows you to inject a specific key from a Kubernetes Secret as an environment variable into a container. This is a standard method for exposing sensitive data like passwords or tokens directly into the container's environment without hardcoding them in the Pod spec.

Answer

Using 'args' in container spec

Answer

Using 'env.valueFrom.configMapKeyRef'

Answer

Using 'volumeMounts' with a secret volume

Question 9

You are writing a Dockerfile and want to ensure that the CMD instruction is overridable when running the container, but the ENTRYPOINT should not be easily overridden. Which combination should you use?

Accepted Answer

ENTRYPOINT ["myapp"]; CMD ["--help"]. It uses the exec form for ENTRYPOINT, which makes ENTRYPOINT the main command that cannot be easily overridden by simply appending arguments to `docker run`. The CMD instruction provides default arguments that can be overridden by passing arguments to `docker run`. This satisfies both requirements: ENTRYPOINT is not easily overridden, and CMD is overridable. Option D lacks a CMD instruction, so there is nothing to override; arguments passed to `docker run` become arguments to ENTRYPOINT, not a replacement of CMD. Option B uses only CMD, so ENTRYPOINT defaults to the shell and is easily overridden via --entrypoint. Option C uses shell form for ENTRYPOINT, which causes CMD and runtime arguments to be ignored, so CMD cannot be overridden — that violates the requirement.

Answer

CMD ["myapp", "--help"]

Answer

ENTRYPOINT myapp; CMD --help

Answer

ENTRYPOINT ["myapp"]

Question 10

You are using a canary deployment pattern with two Deployments: 'web-stable' (version 1) and 'web-canary' (version 2). Both have the label 'app: web'. The Service 'web-svc' selects pods with 'app: web' and 'version: stable'. How do you route traffic to the canary?

Accepted Answer

Add the label 'version: canary' to the canary Deployment's pod template and update the Service's selector to 'app: web, version in (stable, canary)'.. The Service 'web-svc' currently selects pods with 'app: web' and 'version: stable'. To route traffic to the canary pods (version 2), you need to add the label 'version: canary' to the canary Deployment's pod template so that those pods are created with that label. Then, updating the Service's selector to 'app: web, version in (stable, canary)' allows the Service to match both stable and canary pods, distributing traffic between them according to the Service's default round-robin behavior.

Answer

Use kubectl rollout canary on the stable Deployment.

Answer

Create a new Service with selector 'app: web, version: canary' and use an ingress to split traffic.

Answer

Change the Service selector to 'app: web' only (remove version label).

Question 11

You have a Deployment that must run a legacy application that takes up to 5 minutes to start. You need to ensure the liveness probe does not kill the container prematurely. Which probe configuration should you use?

Accepted Answer

Configure a startup probe with a high failureThreshold and appropriate initialDelaySeconds. A startup probe is specifically designed for slow-starting containers. It runs before the liveness probe and allows the container extra time to initialize without being killed. By setting a high failureThreshold (e.g., 30) and an appropriate initialDelaySeconds, the probe can wait up to 5 minutes for the application to start, after which the liveness probe takes over.

Answer

Use a HTTP GET liveness probe with path /healthz and port 8080

Answer

Set livenessProbe.initialDelaySeconds to 300

Answer

Set livenessProbe.periodSeconds to a high value, like 300

Question 12

You want to create a Deployment that runs 5 replicas of a web application. Which kubectl command should you use?

Accepted Answer

kubectl create deployment webapp --image=nginx --replicas=5. To create a Deployment with 5 replicas using a single imperative command, use `kubectl create deployment webapp --image=nginx --replicas=5`. This command directly creates a Deployment and sets the desired replicas. Option A (`kubectl run`) no longer creates a Deployment by default in current Kubernetes versions (1.18+); it creates a single Pod and does not support the `--replicas` flag. Option B (`kubectl create pod`) does not exist and is incorrect. Option C (`kubectl apply -f deployment.yaml`) would also create a Deployment but requires an existing YAML file and is not a single imperative command.

Answer

kubectl run webapp --image=nginx --replicas=5

Answer

kubectl create pod webapp --image=nginx --replicas=5

Answer

kubectl apply -f deployment.yaml

Question 13

A container image requires running as UID 0 but you need to comply with a 'restricted' Pod Security Admission policy. Which SecurityContext setting allows this while still passing the policy?

Accepted Answer

No SecurityContext setting allows running as UID 0 under the restricted policy.. The 'restricted' Pod Security Admission policy requires that containers run as non-root (runAsNonRoot: true) and prohibits setting runAsUser to 0. Since the image requires UID 0, no SecurityContext setting can override this policy constraint; the only way to comply is to modify the image to run as a non-root user. Therefore, option B is correct.

Answer

Set securityContext: { allowPrivilegeEscalation: true }

Answer

Set securityContext: { runAsNonRoot: true, capabilities: { add: ['SYS_ADMIN'] } }

Answer

Set runAsUser: 0 and runAsNonRoot: false

Question 14

Which THREE statements are true about init containers? (Select 3)

Accepted Answer

Init containers must complete successfully before any main container starts. Init containers are specialized containers that run to completion before any main application containers in the pod start. They must exit with a zero status (success) for the pod to proceed to the next init container or to start the main containers. This ensures prerequisite setup tasks are completed before the application runs.

Answer

Init containers support liveness and readiness probes

Answer

Init containers cannot have resource limits

Question 15

You have created a ServiceAccount named 'my-sa' in namespace 'default'. You want a Pod to use this ServiceAccount. Which Pod spec field is correct?

Accepted Answer

serviceAccountName: my-sa. The `serviceAccountName` field in a Pod spec is the standard way to assign a specific ServiceAccount to a Pod. When this field is set to `my-sa`, the Pod will use the token and permissions associated with that ServiceAccount for API authentication and authorization.

Answer

spec.securityContext.serviceAccount: my-sa

Answer

serviceAccount: my-sa

Answer

automountServiceAccountToken: false